Skip to content

Sentry server-side hardening#111

Merged
saltyskip merged 2 commits intomainfrom
sentry-server-hardening
Apr 30, 2026
Merged

Sentry server-side hardening#111
saltyskip merged 2 commits intomainfrom
sentry-server-hardening

Conversation

@saltyskip
Copy link
Copy Markdown
Owner

Summary

  • Wire sentry-tower per-request hubs (NewSentryLayer + SentryHttpLayer) so every HTTP and MCP request gets its own scope with method, URL, matched path, and a transaction.
  • Tag release (git SHA via GIT_SHA build-arg) and environment (ENVIRONMENT env var) so events group by deploy and filter by env. send_default_pii: false.
  • Tag tenant_id, key_id, and transport (http/mcp) on the per-request hub from both auth middlewares — events are no longer anonymous.
  • AppError::into_response now fires tracing::error! (5xx) / tracing::warn! (4xx) so non-panic error paths reach Sentry via sentry-tracing without changing service code.
  • #[tracing::instrument] on all 7 MCP tool methods (stacks cleanly on #[tool]); HTTP handlers were already instrumented.
  • Dockerfile + GitHub Actions deploy steps pass GIT_SHA=$(git rev-parse --short=12 HEAD) so prod builds get a real release tag instead of unknown.

Fly secrets already pushed:

  • rift-api: SENTRY_DSN, ENVIRONMENT=production
  • rift-api-sandbox: SENTRY_DSN, ENVIRONMENT=staging

Test plan

  • cargo fmt -- --check
  • cargo clippy --all-targets -- -D warnings
  • cargo test (145 passed)
  • After deploy, trigger a known-failing route on prod and confirm the Sentry event has release, environment=production, tenant_id, key_id, and a matched-path transaction
  • Trigger a failing MCP tool call and confirm the event has transport=mcp and the tool field set

🤖 Generated with Claude Code

Wires sentry-tower per-request hubs, adds release (git SHA) and
environment tags, and tags tenant_id/key_id on every event so Sentry
output is actionable rather than anonymous.

- sentry::init now sets release (GIT_SHA build-arg), environment
  (ENVIRONMENT env var), and send_default_pii=false
- NewSentryLayer + SentryHttpLayer with transactions on top-level router
- HTTP auth middleware tags tenant_id/key_id/transport on per-request hub
- MCP initialize() does the same, plus #[tracing::instrument] on the 7
  MCP tool methods
- AppError::into_response emits tracing::error!/warn! so error paths
  reach Sentry through sentry-tracing without panicking
- Dockerfile + CI workflow pass GIT_SHA build-arg from current commit

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@vercel
Copy link
Copy Markdown
Contributor

vercel Bot commented Apr 30, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
rift Ready Ready Preview, Comment Apr 30, 2026 7:10pm

Request Review

Aligns with the recommended config from
docs.sentry.io/platforms/rust/logs — ERROR fires both an Event and a
structured Log; INFO/WARN/DEBUG produce a breadcrumb plus a Log; TRACE
is dropped. Also limits noise from tower_http/hyper/h2/reqwest/mongodb
modules via EnvFilter.

Drops the separate sentry-tracing and sentry-tower crates in favor of
the bundled feature-gated integrations on the main sentry crate.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@saltyskip saltyskip merged commit 68bbd1e into main Apr 30, 2026
3 checks passed
@saltyskip saltyskip deleted the sentry-server-hardening branch April 30, 2026 19:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant